iMesh imesh.com iMesh data breach: what happened and what to do
In September 2013 the file sharing client iMesh was hacked and about 49 million accounts were exposed, including email and IP addresses, usernames and salted MD5 password hashes. The data was put up for sale on a dark market site in mid-2016.
View all 13,115 breaches- Breach date
- 22 Sept 2013
- Affected
- 49,467,477
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
iMesh was a media and file sharing client. Have I Been Pwned (HIBP) records that it was hacked in September 2013 and that the data surfaced almost three years later. In mid-2016 the database was put up for sale on a dark market website, and HIBP added 49,467,477 accounts to its index in July 2016.
News coverage at the time reported that the seller was asking for about 0.5 Bitcoin and that iMesh's operator said it was not aware of any hack. iMesh was no longer an active service by then, so there was no live company to run a response, reset passwords or notify members.
What was exposed
HIBP lists email addresses, IP addresses, usernames and passwords. The passwords were stored as salted MD5 hashes. MD5 is an old, fast hashing method, which means attackers can test huge numbers of guesses against it. Common or short passwords from this data should be assumed cracked.
An IP address can hint at your rough location and internet provider. Combined with your email address and username, it helps scammers make phishing messages look personal. The bigger danger is password reuse: if you used your iMesh password on another site, attackers can try it there.
Why this one still matters
The breach is more than a decade old, but the data keeps circulating and gets mixed into the lists used for credential stuffing. If your email is in it, treat any password from that era as exposed.
What to do if you were in it
- 1
Change your iMesh password and any reuse of it
If you still have a iMesh account, set a new password. Then change it on every other account that shares the old one or a close variation. A password manager makes unique passwords painless.
- 2
Turn on two-factor login
Use an authenticator app on your email, banking and shopping accounts. A leaked password then isn't enough to get in.
- 3
Expect phishing that mentions the breach
Scammers use leaked email addresses to send fake security alerts. Don't click links in unexpected messages. Go to the site yourself instead.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your details. Serus monitors breach databases and the dark web and alerts you, but it can't remove data from a breach.
Frequently asked
Was I affected by the iMesh breach?
If you had an iMesh account before September 2013, your email address, username, IP address and password hash may be in the data. Look up your email on Have I Been Pwned or run a free Serus scan.
What was exposed in the iMesh breach?
HIBP lists email addresses, IP addresses, passwords (as salted MD5 hashes) and usernames.
Can I delete my iMesh account?
iMesh is no longer an active service, so there is nothing to log in to. Focus on changing any password you reused elsewhere.
Should I change my password?
Yes, on every site where you used your old iMesh password or something close to it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
